CVE-2017-1000428

flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin…

published January 10, 2018

CVSS
—
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00836 · 57.3th percentile
Published
2018-01-10T02:00Z
EPSS history
Timeline
  • 10 JAN 02:00Z
    flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin…
    cvelistv5